Enterprise PKI Specialist (Contractor)

quberesearchandtechnologies; Greater London; Hybride; GBP 120 000 - 170 000; Plein temps

Avantages offerts par ce poste

Hybrid working model

London-based role

Résumé du poste

Qube Research & Technologies is seeking an Enterprise PKI Specialist on a fixed-term contract. You will architect, implement, and govern enterprise PKI across the organisation, acting as the PKI authority and trusted advisor.

The role demands hands-on engineering, policy development, and collaboration with security, risk, and operations teams to ensure scalable, compliant PKI and certificate lifecycle management.

Qualifications

• Proven experience designing and delivering enterprise PKI environments.
• Extensive experience designing Root CA, Intermediate CA, and Issuing CA architectures.
• 10+ years of experience in enterprise PKI, trust services, or cryptographic infrastructure.
• Strong understanding of offline Root CA designs, trust hierarchy models, certificate policy development, and PKI governance.
• Experience implementing and operating HSM-backed PKI environments.
• Deep knowledge of X.509 certificates, PKCS standards, CRLs, OCSP, certificate validation, and trust chains.

Responsabilités

• Design and deliver enterprise grade PKI architecture and operating model.
• Define root and issuing CA hierarchies and trust models.
• Define certificate policies, naming standards, and operational controls.
• Design highly available PKI infrastructure and supporting services.
• Lead PKI platform migrations and tooling upgrades.
• Establish DR, backup, recovery, and key protection requirements.

Connaissances

PKI design

CA architecture

HSM integration

PKI governance

Stakeholder mgmt

Cryptography

Outils

Venafi

Keyfactor

DigiCert

Sectigo

EJBCA

HashiCorp Vault

AD CS

Description du poste

Enterprise PKI Specialist (Fixed Term Contract)

The Enterprise PKI Specialist is a senior technical specialist responsible for the design, implementation, governance, and evolution of Public Key Infrastructure (PKI) services across Qube Research & Technologies (QRT).

The successful candidate will serve as the organisation's primary PKI subject matter expert, providing strategic guidance, architectural leadership, hands-on engineering expertise, and technical governance across all PKI-related initiatives.

This is a highly specialised role requiring extensive experience designing, building, and modernising PKI environments within large enterprises. The successful candidate will have a proven track record of delivering PKI programmes from initial requirements gathering and architecture design through to implementation, operationalisation, and long-term governance.

PKI Architecture & Delivery

• Design and deliver enterprise grade PKI architecture and supporting operational model .
• Design and implement root and issuing Certificate Authority (CA) hierarchies.
• Define certificate policies, certificate profiles, naming standards, trust models, and operational controls.
• Design resilient, highly available PKI infrastructure and supporting services.
• Lead the implementation and migration of PKI platforms, tooling, and supporting infrastructure.
• Define disaster recovery, backup, recovery, and key protection requirements for PKI services.
• Design and oversee Hardware Security Module (HSM) integration and key management processes.
• Establish operational procedures for certificate issuance, renewal, revocation, recovery, and lifecycle management.
• Ensure solutions are scalable, supportable, and aligned with security and regulatory requirements.

PKI Subject Matter Expertise

• Act as the organisation's recognised PKI authority and trusted advisor.
• Provide expert guidance on certificate authority design, trust models, certificate lifecycle management, revocation strategies, and key protection.
• Advise engineering and platform teams on PKI integration requirements and best practices.
• Review proposed solutions and ensure alignment with established PKI standards and architectural principles.
• Provide technical leadership for complex PKI‑related initiatives and problem resolution.

Machine Identity & Certificate Lifecycle Management

• Develop enterprise approaches for managing machine identities at scale.
• Design and implement automated certificate issuance, renewal, rotation, and revocation processes.
• Support certificate management across infrastructure, cloud, container, networking, and application environments.
• Reduce operational risk associated with certificate expiry and trust failures.
• Define standards for certificate discovery, inventory, monitoring, and reporting.

Stakeholder Engagement & Governance

• Work closely with infrastructure, engineering, cloud, security, risk, and operational teams.
• Translate complex PKI and cryptographic concepts into clear business and technical recommendations.
• Develop PKI standards, policies, procedures, and governance documentation.
• Support audits and regulatory reviews relating to cryptographic and PKI controls.
• Influence technical direction and ensure PKI considerations are embedded within strategic initiatives.

Essential Skills & Experience

• Proven experience designing and delivering enterprise PKI environments from inception through production operation .
• Extensive experience designing Root CA, Intermediate CA, and Issuing CA architectures.
• 10+ years of experience working with enterprise PKI, trust services, or cryptographic infrastructure.
• Strong understanding of offline Root CA designs, trust hierarchy models, certificate policy development, and PKI governance.
• Experience implementing and operating HSM‑backed PKI environments.
• Deep knowledge of X.509 certificates, PKCS standards, CRLs, OCSP, certificate validation, and trust chains.
• Proven experience leading PKI programmes or transformations across multiple organisations .
• Ability to engage effectively with senior stakeholders, architects, engineers, auditors, and operational teams.

Desirable Skills & Experience

• Experience with Venafi, Keyfactor , DigiCert Trust Lifecycle Manager, Sectigo , EJBCA, HashiCorp Vault, or equivalent platforms.
• Experience with Microsoft Active Directory Certificate Services (AD CS) design and migration programmes .
• Experience implementing PKI within AWS, Azure, Kubernetes, and hybrid cloud environments.
• Experience supporting financial services, regulated industries, or large‑scale enterprise environments.
• Relevant industry certifications in security, architecture, cloud, or cryptography.

Contract Details

• Fixed Term Contract
• Hybrid working model
• London-based role
• Competitive package dependent on experience